Log in Request a demo

Threat group profile

APT18

Also known as TG-0416, Dynamite Panda, Threat Group-0416

APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing, government and medical sectors.

In short

APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing, government and medical sectors. A US health sector briefing (HHS HC3, 2020) lists suspected attribution to China; no advisory, indictment or named sponsor was found.

Last updated 10 October 2026

Profile MapThreat Group
  1. Names5names in public reportsAPT18 · TG-0416 · Dynamite Panda
  2. Sectors6named as targetsTechnology sector · Manufacturing sector · Human rights groups
  3. Techniques12in the attack chainInitial Access · Execution · Persistence
  4. Tools5tools and malware listedhcdLoader · Pisloader · HTTPBrowser

In one minute

Who they are
MITRE ATT&CK describes APT18 (G0026) as a threat group active since at least 2009. MITRE names no country or sponsor. A US health sector briefing (HHS HC3, 19 November 2020) lists suspected attribution to China. No advisory, indictment or sanction naming the group was found.
Who they target
MITRE lists technology, manufacturing, human rights groups, government and medical organizations.
How they usually get in
MITRE says APT18 actors use legitimate credentials to log in to external remote services.
What stands out
MITRE lists malware that uses DNS for command and control, such as Pisloader, along with HTTP command and control. The public record is thin and comes from MITRE and one US briefing.
What to do first
Require multi-factor authentication on all remote access and audit which accounts can log in from outside.

Names

Public reports use several names for this activity.

Names used for APT18
NameWhere it appears
APT18 MITRE ATT&CK group name[1]
TG-0416 MITRE ATT&CK Associated Groups; HHS HC3 briefing of 19 November 2020[1, 19]
Dynamite Panda MITRE ATT&CK Associated Groups; HHS HC3 briefing of 19 November 2020[1, 19]
Threat Group-0416 MITRE ATT&CK Associated Groups[1]
Wekby HHS HC3 briefing of 19 November 2020 (profile titled APT18 AKA Wekby)[19]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK 31 July 2026 (page last modified)

    Describes APT18 as a threat group that has operated since at least 2009 and has targeted technology, manufacturing, human rights groups, government and medical organizations. The page names no country and no sponsor.[1]

  • US Department of Health and Human Services (HC3) 19 November 2020

    In a briefing on Chinese state-sponsored activity, lists APT18 (also known as Wekby, TG-0416 and Dynamite Panda) with suspected attribution to China, and says very little has been released publicly about the group. It names no unit or sponsor.[19]

Where sources differ

Sources differ on origin. MITRE ATT&CK names no country or sponsor for APT18. The HHS HC3 briefing of 19 November 2020 lists the suspected attribution as China and says very little has been released publicly about the group. It names no unit, and it is a briefing, not an indictment or an advisory. MITRE's page on HTTPBrowser says that malware is believed to be of Chinese origin, but that sentence is about the malware, which several groups have used, not about APT18. No government source opened for this page names a unit or a sponsor, so this profile does not state one.

Who they target

Sectors

  • Technology sectorMITRE lists technology among the industries APT18 has targeted[1]
  • Manufacturing sectorMITRE lists manufacturing among the industries targeted[1]
  • Human rights groupsMITRE lists human rights groups among the targets[1]
  • Government organizationsMITRE lists government among the targets[1]
  • Medical sectorMITRE lists medical among the industries targeted[1]
  • Aerospace and defense, construction and engineering, education, high tech, telecommunications, transportation, and health and biotechnologyHHS HC3 lists these as target sectors for APT18[19]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. 2009

    Earliest activity per MITRE

    MITRE ATT&CK says APT18 has operated since at least 2009. It gives no individual operations, dates or victims on the group page.[1]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about APT18
DateWhoWhat
19 Nov 2020 US Department of Health and Human Services (HC3) Threat briefingIncludes a profile of APT18 with its names, suspected attribution to China, target sectors and associated malware. It is a briefing, not an indictment, sanction or advisory.[19]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Initial Access

  • External Remote Services T1133

    MITRE says APT18 actors use legitimate credentials to log into external remote services.[1, 7]

  • Valid Accounts T1078

    Same MITRE statement: legitimate credentials are used to log in to external remote services.[1, 8]

Execution

  • Command and Scripting Interpreter: Windows Command Shell T1059.003

    MITRE says APT18 uses cmd.exe to run commands on the victim's machine.[1, 12]

  • Scheduled Task/Job: At T1053.002

    MITRE says APT18 actors used the built-in Windows at tool to schedule tasks for execution on a victim network.[1, 17]

Persistence

  • Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001

    MITRE says APT18 sets up persistence through the HKCU Run registry key.[1, 11]

Discovery

  • File and Directory Discovery T1083

    MITRE says APT18 can list file information for specific directories.[1, 13]

  • System Information Discovery T1082

    MITRE says APT18 can collect system information from the victim's machine.[1, 18]

Command and Control

  • Application Layer Protocol: Web Protocols T1071.001

    MITRE says APT18 uses HTTP for command and control.[1, 9]

  • Application Layer Protocol: DNS T1071.004

    MITRE says APT18 uses DNS for command and control.[1, 10]

  • Ingress Tool Transfer T1105

    MITRE says APT18 can upload a file to the victim's machine.[1, 15]

Stealth

  • Indicator Removal: File Deletion T1070.004

    MITRE says APT18 actors deleted tools and batch files from victim systems.[1, 14]

  • Obfuscated Files or Information: Encrypted/Encoded File T1027.013

    MITRE says APT18 obfuscates strings in its payload.[1, 16]

Tools and malware

  • hcdLoader Remote access tool

    MITRE describes it as a remote access tool that has been used by APT18.[1, 2]

  • Pisloader Malware family

    MITRE says it uses DNS for command and control, has been used by APT18, and is similar to HTTPBrowser.[1, 3]

  • HTTPBrowser Malware

    MITRE lists it for APT18 and says several threat groups have used it.[1, 4]

  • gh0st RAT Remote access tool

    MITRE lists it for APT18 and says its source code is public and many groups have used it.[1, 5]

  • cmd Windows tool

    The built-in Windows command-line interpreter, which MITRE lists for APT18.[1, 6]

Detection and defense

  1. Require multi-factor authentication on remote access

    MITRE's mitigation for external remote services and valid accounts is strong multi-factor authentication, so stolen credentials alone do not work.

    Counters T1133 T1078

  2. Limit and manage remote access paths

    Turn off remote services you do not need and route access through centrally managed VPNs or gateways, as MITRE advises.

    Counters T1133

  3. Audit accounts regularly

    MITRE advises routine audits of user and privileged accounts and removing accounts that are no longer needed.

    Counters T1078

  4. Filter DNS and web traffic from servers

    MITRE advises filtering DNS requests to untrusted domains and limiting outbound web traffic to approved destinations.

    Counters T1071.004 T1071.001

  5. Block outbound traffic to unapproved destinations

    MITRE advises network filtering and intrusion prevention to stop tools being downloaded onto compromised systems.

    Counters T1105 T1071.001

  6. Control who can schedule tasks

    MITRE advises limiting privileges so only authorized administrators can create scheduled tasks on remote systems.

    Counters T1053.002

  7. Watch for new Run key entries

    MITRE says this technique is hard to prevent, so detect registry Run key changes that point to new or unusual programs.

    Counters T1547.001

What Brandefense can do

Questions

What is APT18?

MITRE ATT&CK describes APT18 (G0026) as a threat group that has operated since at least 2009 and has targeted technology, manufacturing, human rights groups, government and medical organizations.

What other names does it have?

MITRE lists TG-0416, Dynamite Panda and Threat Group-0416 as associated names. The HHS HC3 briefing of 19 November 2020 also uses Wekby.

Which country is behind it?

MITRE names no country or sponsor. The HHS Health Sector Cybersecurity Coordination Center (HC3) lists the suspected attribution as China in a briefing of 19 November 2020 and says very little has been released publicly. No indictment, advisory or unit attribution was found, so this profile makes no firmer claim.

How does it get in?

MITRE says APT18 actors use legitimate credentials to log in to external remote services. It also lists HTTP and DNS for command and control.

What should I do first?

Require multi-factor authentication on VPN and other remote access, and audit which accounts can log in from outside.

In our research

  1. APT15 (Ke3Chang / Nylon Typhoon): China-Aligned Cyber Espionage APT January 2026
  2. Dynamite Panda APT Group August 2022

Sources

  1. APT18, Group G0026 MITRE ATT&CK Supports: Group description, associated names, techniques, software list, version 2.2, created 31 May 2017, last modified 31 July 2026
  2. hcdLoader, Software S0071 MITRE ATT&CK Supports: Remote access tool described as used by APT18
  3. Pisloader, Software S0124 MITRE ATT&CK Supports: Malware family that uses DNS for command and control, described as used by APT18
  4. HTTPBrowser, Software S0070 MITRE ATT&CK Supports: Malware used by several groups, listed among the software for APT18
  5. gh0st RAT, Software S0032 MITRE ATT&CK Supports: Public-source remote access tool used by multiple groups, listed among the software for APT18
  6. cmd, Software S0106 MITRE ATT&CK Supports: Windows command-line interpreter, listed among the software for APT18
  7. External Remote Services, Technique T1133 MITRE ATT&CK Supports: Technique name, tactics and mitigations
  8. Valid Accounts, Technique T1078 MITRE ATT&CK Supports: Technique name, tactics and mitigations
  9. Application Layer Protocol: Web Protocols, Sub-technique T1071.001 MITRE ATT&CK Supports: Technique name, tactic and mitigations
  10. Application Layer Protocol: DNS, Sub-technique T1071.004 MITRE ATT&CK Supports: Technique name, tactic and mitigations
  11. Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 MITRE ATT&CK Supports: Technique name, tactics and detection note
  12. Command and Scripting Interpreter: Windows Command Shell, Sub-technique T1059.003 MITRE ATT&CK Supports: Technique name and tactic
  13. File and Directory Discovery, Technique T1083 MITRE ATT&CK Supports: Technique name and tactic
  14. Indicator Removal: File Deletion, Sub-technique T1070.004 MITRE ATT&CK Supports: Technique name and tactic
  15. Ingress Tool Transfer, Technique T1105 MITRE ATT&CK Supports: Technique name, tactic and mitigations
  16. Obfuscated Files or Information: Encrypted/Encoded File, Sub-technique T1027.013 MITRE ATT&CK Supports: Technique name and tactic
  17. Scheduled Task/Job: At, Sub-technique T1053.002 MITRE ATT&CK Supports: Technique name, tactics and mitigations
  18. System Information Discovery, Technique T1082 MITRE ATT&CK Supports: Technique name and tactic
  19. Chinese State-Sponsored Cyber Activity (Report 202011191030, TLP:WHITE) US Department of Health and Human Services, Health Sector Cybersecurity Coordination Center (HC3); copy opened on the American Hospital Association website Supports: Threat group profile of APT18: names, suspected attribution to China, target sectors

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Glossary term

Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Read more

Technique

External Remote Services

External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it.

Read more

Technique

Valid Accounts

Valid Accounts means an attacker logs in with real credentials that were stolen or bought.

Read more